Examkin

Question

Difficulty: MediumMitigation Strategies and Enterprise Hardening Practices

A security analyst is hardening administrative workstations used by system engineers to manage enterprise infrastructure. Security monitoring reveals that attackers frequently attempt to execute unauthorized scripts and portable binaries directly from user temporary directories such as `%TEMP%` and `%APPDATA%`. Which mitigation strategy best prevents the execution of these unapproved binaries while maintaining administrative functionality?

  1. Implement application allowlisting policies that restrict software execution based on file paths, digital signatures, and cryptographic hashes.Answer
  2. B
    Deploy a network intrusion prevention system (NIPS) at the access layer firewall to block unauthorized script execution traffic.
  3. C
    Require multi-factor authentication (MFA) for initial interactive user logins to the workstation subnet.
  4. D
    Configure file integrity monitoring (FIM) to generate real-time alerts whenever executable files are dropped into temporary user directories.

Answer

Implementing application allowlisting policies that restrict software execution based on file paths, digital signatures, and cryptographic hashes is the most effective mitigation strategy.
Application allowlisting operates as a host-based preventive control that specifies exactly which scripts, binaries, and libraries are permitted to run based on publisher signatures, hashes, or trusted paths. By enforcing an implicit deny posture for unapproved paths like `%TEMP%` and `%APPDATA%`, it prevents execution of unauthorized software.

Step-by-Step Solution

1
Analyze the threat vector identified in the scenario.
The primary threat is the local execution of unapproved binaries and scripts from writable temporary directories (%TEMP% and %APPDATA%).
Temporary directories are world-writable by default, making them common targets for executing unauthorized or malicious payloads.
2
Evaluate the required security control type.
A preventive host-based control is required to actively block unapproved application execution.
Detective controls (like logging/FIM) or perimeter controls (like NIPS/MFA) do not stop the local binary from running.
3
Identify the host hardening technique that restricts executable permission based on trust boundaries.
Application allowlisting (such as AppLocker or Software Restriction Policies) prevents binaries outside trusted paths or lacking valid vendor signatures from running.
Allowlisting defaults to implicit deny, ensuring only verified software executes regardless of user write permissions in temporary folders.

Key Concept

Application Allowlisting and Enterprise Host Hardening
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic